SHARE
TWEET

Unknown botnet

James_inthe_box Jan 29th, 2019 (edited) 623 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. Yara rule:
  2.  
  3. rule Unknown_botnet_bin
  4. {
  5.     meta:
  6.     description = "Unknown botnet"
  7.         author = "James_inthe_box"
  8.     reference = "https://app.any.run/tasks/5a12dfe2-ba7a-4efe-8062-d710e7350c94"
  9.         date = "2019/01"
  10.         maltype = "Bot"
  11.        
  12.     strings:
  13.     $mz = { 4d 5a }
  14.         $string1 = "[%d] ERROR: %d, %s: %d"
  15.     $string2 = "download|update|delete|nothing|plugin_start|plugin_stop|plugin_delete"
  16.         $string3 = "plugin_start"
  17.         $string4 = "plugin_stop"
  18.         $string5 = "plugin_delete"
  19.        
  20.     condition:
  21.     ($mz at 0) and all of ($string*) and filesize < 100KB
  22. }
  23.  
  24. rule Unknown_botnet_mem
  25. {
  26.     meta:
  27.         description = "Unknown botnet"
  28.         author = "James_inthe_box"
  29.         reference = "https://app.any.run/tasks/5a12dfe2-ba7a-4efe-8062-d710e7350c94"
  30.         date = "2019/01"
  31.         maltype = "Bot"
  32.  
  33.     strings:
  34.         $string1 = "[%d] ERROR: %d, %s: %d"
  35.         $string2 = "download|update|delete|nothing|plugin_start|plugin_stop|plugin_delete"
  36.         $string3 = "plugin_start"
  37.         $string4 = "plugin_stop"
  38.         $string5 = "plugin_delete"
  39.  
  40.     condition:
  41.         all of ($string*) and filesize > 100KB
  42. }
  43.  
  44. snort/suricata sig:
  45. alert tcp $HOME_NET any -> $EXTERNAL_NET !$HTTP_PORTS (msg:"Unknown Botnet Download"; flow:established,to_server; content:"|62 23 ad 07 62 23 ad 07 62 23 ad 07 62 23 ad 07 62 23 ad 07 62 23 ad 07 62 23 ad 07 62 23 ad 07|"; reference:url,https://app.any.run/tasks/5a12dfe2-ba7a-4efe-8062-d710e7350c94; classtype:trojan-activity; sid:20166284; rev:1; metadata:created_at 2019_01_29;)
  46.  
  47. alert tcp $HOME_NET any -> $EXTERNAL_NET !$HTTP_PORTS (msg:"Unknown Botnet Checkin-Keepalive"; flow:established,to_server; content:"|d2 37 81 e4|"; content:"|e6 07 00 00 85 78 d3 a8 96 37 81 e4 d2 37 81 e4 d2 37 81 e4|"; distance:44; reference:url,https://app.any.run/tasks/5a12dfe2-ba7a-4efe-8062-d710e7350c94; classtype:trojan-activity; sid:20166285; rev:1; metadata:created_at 2019_01_29;)
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
 
Top